Skip to Content
Last modified by Aaron Rosenzweig on 2012/03/19 19:33
From version 47.1
edited by Kieran Kelleher
on 2008/07/21 18:13
Change comment: There is no comment for this version
To version 54.1
edited by Pascal Robert
on 2012/01/27 09:14
Change comment: There is no comment for this version

Summary

Details

Page properties
Title
... ... @@ -1,1 +1,1 @@
1 -Web Applications-Development-SSL requests via https protocol
1 +Development-SSL requests via https protocol
Author
... ... @@ -1,1 +1,1 @@
1 -XWiki.kieran
1 +XWiki.probert
Content
... ... @@ -1,6 +1,6 @@
1 1  == Introduction ==
2 2  
3 -Sooner or later you will need to develop WebObjects applications that work with SSL requests over https protocol. If ssl is configured on your deployment server, you can probably just change http to https in the app entry URL and the app will probably just work over https protocol. However if your application requires security, you cannot just depend on your users typing in a URL that begins with https. Also since SSL encryption adds more load to the webserver, you may want decide that just some pages need to be returned securely over https and the rest returned via plain old http. In any case, you may want to or need to set up your local OS X development machine to support https protocol so that you can properly test your application. This article endeavors to do this in a concise way while referring to 3rd party sources where applicable. Note also that setting up ssl for testing can be a far simpler task (and not really secure) than setting up real authentic SSL certificates for use in a production server.
3 +Sooner or later you will need to develop WebObjects applications that work with SSL requests over https protocol. If ssl is configured on your deployment server, you can probably just change http to https in the app entry URL and the app will probably just work over https protocol. However if your application requires security, you cannot just depend on your users typing in a URL that begins with https. Also since SSL encryption adds more load to the webserver, you may want decide that just some pages need to be returned securely over https and the rest returned via plain old http. In any case, you may want to or need to set up your local OS X development machine to support https protocol so that you can properly test your application. Note also that setting up ssl for testing can be a far simpler task (and not really secure) than setting up real authentic SSL certificates for use in a production server.
4 4  
5 5  {{info title="Compatability"}}
6 6  
... ... @@ -15,6 +15,14 @@
15 15  
16 16  {{/info}}
17 17  
18 +=== References ===
19 +
20 +* [[http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#selfcert]]
21 +* [[http://homepage.mac.com/kelleherk/iblog/C463983418/E683365024/index.html]]
22 +* [[http://www.macosxhints.com/article.php?story=20080628074917113]]
23 +* [[http://www.macosxhints.com/article.php?story=20041129143420344]]
24 +* [[http://developer.apple.com/internet/serverside/modssl.html]]
25 +
18 18  == Development via Apache Webserver ==
19 19  
20 20  By default, WebObjects development installations typically run via DirectConnect. For https development, we must run thru the apache webserver built in to every OS X machine. So before going any further, configure your WebObjects development environment so that your development application launches and [[runs thru apache>>Development Tools-Running Through Apache]] using the host name "localhost".
... ... @@ -43,7 +43,7 @@
43 43  
44 44  {{noformat}}
45 45  
46 -bash-3.2# openssl req -new -x509 -nodes -out localhost_server.crt -keyout localhost_server.key
54 +bash-3.2# openssl req -days 3650 -new -x509 -nodes -out localhost_server.crt -keyout localhost_server.key
47 47  
48 48  Generating a 1024 bit RSA private key
49 49  .........................++++++
... ... @@ -77,17 +77,34 @@
77 77  
78 78  === Configure Apache2 to Use Your Development Certificates for localhost ===
79 79  
80 -Using you favorite text editor, edit the apache2 config file at
81 -/etc/apache2/httpd.conf
88 +Using your favorite command line editor, edit the apache config file at
89 +**/etc/apache2/httpd.conf**
82 82  making the changes shown in the following 2 screenshots:
83 83  
84 -[[image:step1_servernamelocalhost.jpg]]
85 - [[image:step2_includesslconfig.jpg]]
86 - 
87 -Next edit the ssl config file itself making the changes shown in the following sceenshot:
88 -\\ [[image:step3_sslconfig.jpg]]
89 -\\Finally, restart apache
92 +{{panel title="Setting Apache server name to localhost"}}
90 90  
94 +!step1_servernamelocalhost.jpg!
95 +
96 +{{/panel}}
97 +
98 +{{panel title="Including SSL Configuration file into main Apache config file"}}
99 +
100 +!step2_includesslconfig.jpg!
101 +
102 +{{/panel}}
103 +
104 +Next edit the ssl config file itself at
105 +**/etc/apache2/extra/httpd-ssl.conf**
106 +making the changes shown in the following sceenshot:
107 +
108 +{{panel title="Setting up the SSL Config file"}}
109 +
110 +!step3_sslconfig.jpg!
111 +
112 +{{/panel}}
113 +
114 +Restart apache
115 +
91 91  {{noformat}}
92 92  
93 93  bash-3.2# apachectl graceful
... ... @@ -94,6 +94,30 @@
94 94  
95 95  {{/noformat}}
96 96  
122 +~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-
123 +
124 +JEFF SCHMITZ
125 +
126 +Right at this point I got the error:
127 +
128 +ulimit: open files: cannot modify limit: Invalid arg
129 +
130 +After a quick google search I found this which seems to have fixed the error:
131 +
132 +[[http://www.perkiset.org/forum/all_things_apple/apache_osx_and_ulimit_a_little_chunk_of_weirdness-t909.0.html]]
133 +
134 +Also, for my [[https://]]... links my rewrite rules in apache weren't getting fired.  To get them to work I had to add them to the httpd-ssl.conf file just below the General setup stuff shown in the figure above.  I just copied them from my httpd.conf file and pasted them in.  Not sure if this is the best way to handle it, but it's working for me on my development machine at least.
135 +
136 +~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-
137 +
138 +Finally, verify that https is working:
139 +
140 +{{panel title="Verify https://localhost is working"}}
141 +
142 +!httpslocalhost2.jpg!
143 +
144 +{{/panel}}
145 +
97 97  == Detecting SSL ==
98 98  
99 99  Code for detecting whether SSL is active for the current request:
... ... @@ -120,3 +120,37 @@
120 120  log.debug( "secure mode set to " + secureMode );
121 121  
122 122  {{/code}}
172 +
173 +== Using SSL in DirectConnect ==
174 +
175 +Mike Schrag said in early 2011 that it was possible to use SSL in DirectConnect, that is was simply hidden. A property was added to enable it, and instructions added to the Properties file of ERExtensions. This is the part from the Properties file:
176 +
177 +{{code}}
178 +
179 +
180 +## You should probably not enable any of these settings in a normal Apache webserver deployment,
181 +## in particular the ssl port property, as this is used by ERX to generate https URLs, which must
182 +## match your Apache config.
183 +##
184 +## To enable SSL support with DirectConnect, you must do the following:
185 +##
186 +## * In your Resources folder, run "keytool -genkey -alias WebObjects -keyalg RSA -keystore adaptorssl.key". Select a
187 +## password for your keystore (i.e. "changeit"), and set the "your first name and last name" field to match the hostname
188 +## that you will be running your directconnect app off of.
189 +## * In your Resources folder, create an executable script (it MUST BE EXECUTABLE) named "adaptorsslpassphrase" with the
190 +## contents:
191 +## echo changeit
192 +## where you should replace "changeit" for whatever password you selected in the previous step.
193 +## * Set the following property to true
194 +#er.extensions.ERXApplication.ssl.enabled=true
195 +
196 +## (optional) To specify an SSL host name other than what is returned from a call to
197 +## application.host(), you can override it below
198 +#er.extensions.ERXApplication.ssl.host=localhost
199 +
200 +## (optional) To select an SSL port other than 443, uncomment the following. If you are already running Apache with SSL,
201 +## you probably want to set this. If the port number is 0, the SSL port will be automatically assigned (using the same
202 +## mechanism that WO uses to set the regular port)
203 +#er.extensions.ERXApplication.ssl.port=0
204 +
205 +{{/code}}